Changeset 745 for trunk/server/source3/libsmb/libsmb_xattr.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/libsmb/libsmb_xattr.c (modified) (140 diffs)

trunk/server/source3/libsmb/libsmb_xattr.c

@@ -8 +8 @@
    Copyright (C) Derrell Lipman 2003-2008
    Copyright (C) Jeremy Allison 2007, 2008
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -24 +24 @@
 
 #include "includes.h"
+#include "libsmb/libsmb.h"
 #include "libsmbclient.h"
 #include "libsmb_internal.h"
-
+#include "../librpc/gen_ndr/ndr_lsa.h"
+#include "rpc_client/rpc_client.h"
+#include "rpc_client/cli_lsarpc.h"
+#include "../libcli/security/security.h"
 
 /*
@@ -35 +39 @@
 {
         struct rpc_pipe_client *pipe_hnd;
-        
+
         for (pipe_hnd = ipc_cli->pipe_list;
              pipe_hnd;
              pipe_hnd = pipe_hnd->next) {
-                
                 if (ndr_syntax_id_equal(&pipe_hnd->abstract_syntax,
                                         &ndr_table_lsarpc.syntax_id)) {
@@ -45 +48 @@
                 }
         }
-        
         return NULL;
 }
@@ -56 +58 @@
 
 static int
-ace_compare(SEC_ACE *ace1,
-            SEC_ACE *ace2)
+ace_compare(struct security_ace *ace1,
+            struct security_ace *ace2)
 {
         bool b1;
         bool b2;
-        
+
         /* If the ACEs are equal, we have nothing more to do. */
         if (sec_ace_equal(ace1, ace2)) {
                 return 0;
         }
-        
+
         /* Inherited follow non-inherited */
         b1 = ((ace1->flags & SEC_ACE_FLAG_INHERITED_ACE) != 0);
@@ -73 +75 @@
                 return (b1 ? 1 : -1);
         }
-        
+
         /*
          * What shall we do with AUDITs and ALARMs?  It's undefined.  We'll
@@ -89 +91 @@
                 return (b1 ? 1 : -1);
         }
-        
+
         /* Allowed ACEs follow denied ACEs */
         b1 = (ace1->type == SEC_ACE_TYPE_ACCESS_ALLOWED ||
@@ -98 +100 @@
                 return (b1 ? 1 : -1);
         }
-        
+
         /*
          * ACEs applying to an entity's object follow those applying to the
@@ -110 +112 @@
                 return (b1 ? 1 : -1);
         }
-        
+
         /*
          * If we get this far, the ACEs are similar as far as the
@@ -117 +119 @@
          * just seems reasonable.
          */
-        
+
         if (ace1->type != ace2->type) {
                 return ace2->type - ace1->type;
         }
-        
-        if (sid_compare(&ace1->trustee, &ace2->trustee)) {
-                return sid_compare(&ace1->trustee, &ace2->trustee);
-        }
-        
+
+        if (dom_sid_compare(&ace1->trustee, &ace2->trustee)) {
+                return dom_sid_compare(&ace1->trustee, &ace2->trustee);
+        }
+
         if (ace1->flags != ace2->flags) {
                 return ace1->flags - ace2->flags;
         }
-        
+
         if (ace1->access_mask != ace2->access_mask) {
                 return ace1->access_mask - ace2->access_mask;
         }
-        
+
         if (ace1->size != ace2->size) {
                 return ace1->size - ace2->size;
         }
-        
-        return memcmp(ace1, ace2, sizeof(SEC_ACE));
+
+        return memcmp(ace1, ace2, sizeof(struct security_ace));
 }
 
 
 static void
-sort_acl(SEC_ACL *the_acl)
+sort_acl(struct security_acl *the_acl)
 {
         uint32 i;
         if (!the_acl) return;
-        
-        qsort(the_acl->aces, the_acl->num_aces, sizeof(the_acl->aces[0]),
-              QSORT_CAST ace_compare);
-        
+
+        TYPESAFE_QSORT(the_acl->aces, the_acl->num_aces, ace_compare);
+
         for (i=1;i<the_acl->num_aces;) {
                 if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
@@ -170 +171 @@
                       fstring str,
                       bool numeric,
-                      DOM_SID *sid)
+                      struct dom_sid *sid)
 {
         char **domains = NULL;
@@ -177 +178 @@
         struct rpc_pipe_client *pipe_hnd = find_lsa_pipe_hnd(ipc_cli);
         TALLOC_CTX *ctx;
-        
+
         sid_to_fstring(str, sid);
-        
+
         if (numeric) {
                 return;     /* no lookup desired */
         }
-        
+
         if (!pipe_hnd) {
                 return;
         }
-        
+
         /* Ask LSA to convert the sid to a name */
-        
+
         ctx = talloc_stackframe();
-        
+
         if (!NT_STATUS_IS_OK(rpccli_lsa_lookup_sids(pipe_hnd, ctx,
                                                     pol, 1, sid, &domains,
@@ -199 +200 @@
                 return;
         }
-        
+
         /* Converted OK */
-        
+
         slprintf(str, sizeof(fstring) - 1, "%s%s%s",
                  domains[0], lp_winbind_separator(),
@@ -214 +215 @@
                       struct policy_handle *pol,
                       bool numeric,
-                      DOM_SID *sid,
+                      struct dom_sid *sid,
                       const char *str)
 {
         enum lsa_SidType *types = NULL;
-        DOM_SID *sids = NULL;
+        struct dom_sid *sids = NULL;
         bool result = True;
         TALLOC_CTX *ctx = NULL;
         struct rpc_pipe_client *pipe_hnd = find_lsa_pipe_hnd(ipc_cli);
-        
+
         if (!pipe_hnd) {
                 return False;
         }
-        
+
         if (numeric) {
                 if (strncmp(str, "S-", 2) == 0) {
                         return string_to_sid(sid, str);
                 }
-                
+
                 result = False;
                 goto done;
         }
-        
+
         ctx = talloc_stackframe();
         if (!NT_STATUS_IS_OK(rpccli_lsa_lookup_names(pipe_hnd, ctx,
@@ -244 +245 @@
                 goto done;
         }
-        
+
         sid_copy(sid, &sids[0]);
 done:
-        
         TALLOC_FREE(ctx);
         return result;
@@ -253 +253 @@
 
 
-/* parse an ACE in the same format as print_ace() */
+/* parse an struct security_ace in the same format as print_ace() */
 static bool
 parse_ace(struct cli_state *ipc_cli,
           struct policy_handle *pol,
-          SEC_ACE *ace,
+          struct security_ace *ace,
           bool numeric,
           char *str)
@@ -267 +267 @@
         unsigned int aflags;
         unsigned int amask;
-        DOM_SID sid;
+        struct dom_sid sid;
         uint32_t mask;
         const struct perm_value *v;
@@ -275 +275 @@
         };
         TALLOC_CTX *frame = talloc_stackframe();
-        
+
         /* These values discovered by inspection */
         static const struct perm_value special_values[] = {
@@ -286 +286 @@
                 { "", 0 },
         };
-        
+
         static const struct perm_value standard_values[] = {
                 { "READ",   0x001200a9 },
@@ -293 +293 @@
                 { "", 0 },
         };
-        
-        
+
         ZERO_STRUCTP(ace);
         p = strchr_m(str,':');
@@ -304 +303 @@
         p++;
         /* Try to parse numeric form */
-        
+
         if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
             convert_string_to_sid(ipc_cli, pol, numeric, &sid, str)) {
                 goto done;
         }
-        
+
         /* Try to parse text form */
-        
+
         if (!convert_string_to_sid(ipc_cli, pol, numeric, &sid, str)) {
                 TALLOC_FREE(frame);
                 return false;
         }
-        
+
         cp = p;
         if (!next_token_talloc(frame, &cp, &tok, "/")) {
@@ -322 +321 @@
                 return false;
         }
-        
+
         if (StrnCaseCmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
                 atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
@@ -331 +330 @@
                 return false;
         }
-        
+
         /* Only numeric form accepted for flags at present */
-        
+
         if (!(next_token_talloc(frame, &cp, &tok, "/") &&
               sscanf(tok, "%i", &aflags))) {
@@ -339 +338 @@
                 return false;
         }
-        
+
         if (!next_token_talloc(frame, &cp, &tok, "/")) {
                 TALLOC_FREE(frame);
                 return false;
         }
-        
+
         if (strncmp(tok, "0x", 2) == 0) {
                 if (sscanf(tok, "%i", &amask) != 1) {
@@ -352 +351 @@
                 goto done;
         }
-        
+
         for (v = standard_values; v->perm; v++) {
                 if (strcmp(tok, v->perm) == 0) {
@@ -359 +358 @@
                 }
         }
-        
+
         p = tok;
-        
+
         while(*p) {
                 bool found = False;
-                
+
                 for (v = special_values; v->perm; v++) {
                         if (v->perm[0] == *p) {
@@ -371 +370 @@
                         }
                 }
-                
+
                 if (!found) {
                         TALLOC_FREE(frame);
@@ -378 +377 @@
                 p++;
         }
-        
+
         if (*p) {
                 TALLOC_FREE(frame);
                 return false;
         }
-        
+
 done:
         mask = amask;
@@ -391 +390 @@
 }
 
-/* add an ACE to a list of ACEs in a SEC_ACL */
+/* add an struct security_ace to a list of struct security_aces in a struct security_acl */
 static bool
-add_ace(SEC_ACL **the_acl,
-        SEC_ACE *ace,
+add_ace(struct security_acl **the_acl,
+        struct security_ace *ace,
         TALLOC_CTX *ctx)
 {
-        SEC_ACL *newacl;
-        SEC_ACE *aces;
-        
+        struct security_acl *newacl;
+        struct security_ace *aces;
+
         if (! *the_acl) {
                 (*the_acl) = make_sec_acl(ctx, 3, 1, ace);
                 return True;
         }
-        
-        if ((aces = SMB_CALLOC_ARRAY(SEC_ACE,
+
+        if ((aces = SMB_CALLOC_ARRAY(struct security_ace,
                                      1+(*the_acl)->num_aces)) == NULL) {
                 return False;
         }
-        memcpy(aces, (*the_acl)->aces, (*the_acl)->num_aces * sizeof(SEC_ACE));
-        memcpy(aces+(*the_acl)->num_aces, ace, sizeof(SEC_ACE));
+        memcpy(aces, (*the_acl)->aces, (*the_acl)->num_aces * sizeof(struct security_ace));
+        memcpy(aces+(*the_acl)->num_aces, ace, sizeof(struct security_ace));
         newacl = make_sec_acl(ctx, (*the_acl)->revision,
                               1+(*the_acl)->num_aces, aces);
@@ -420 +419 @@
 
 /* parse a ascii version of a security descriptor */
-static SEC_DESC *
+static struct security_descriptor *
 sec_desc_parse(TALLOC_CTX *ctx,
                struct cli_state *ipc_cli,
@@ -429 +428 @@
         const char *p = str;
         char *tok;
-        SEC_DESC *ret = NULL;
+        struct security_descriptor *ret = NULL;
         size_t sd_size;
-        DOM_SID *group_sid=NULL;
-        DOM_SID *owner_sid=NULL;
-        SEC_ACL *dacl=NULL;
+        struct dom_sid *group_sid=NULL;
+        struct dom_sid *owner_sid=NULL;
+        struct security_acl *dacl=NULL;
         int revision=1;
-        
+
         while (next_token_talloc(ctx, &p, &tok, "\t,\r\n")) {
-                
+
                 if (StrnCaseCmp(tok,"REVISION:", 9) == 0) {
                         revision = strtol(tok+9, NULL, 16);
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"OWNER:", 6) == 0) {
                         if (owner_sid) {
@@ -448 +447 @@
                                 goto done;
                         }
-                        owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
+                        owner_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
                         if (!owner_sid ||
                             !convert_string_to_sid(ipc_cli, pol,
@@ -458 +457 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"OWNER+:", 7) == 0) {
                         if (owner_sid) {
@@ -464 +463 @@
                                 goto done;
                         }
-                        owner_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
+                        owner_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
                         if (!owner_sid ||
                             !convert_string_to_sid(ipc_cli, pol,
@@ -474 +473 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"GROUP:", 6) == 0) {
                         if (group_sid) {
@@ -480 +479 @@
                                 goto done;
                         }
-                        group_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
+                        group_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
                         if (!group_sid ||
                             !convert_string_to_sid(ipc_cli, pol,
@@ -490 +489 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"GROUP+:", 7) == 0) {
                         if (group_sid) {
@@ -496 +495 @@
                                 goto done;
                         }
-                        group_sid = SMB_CALLOC_ARRAY(DOM_SID, 1);
+                        group_sid = SMB_CALLOC_ARRAY(struct dom_sid, 1);
                         if (!group_sid ||
                             !convert_string_to_sid(ipc_cli, pol,
@@ -506 +505 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"ACL:", 4) == 0) {
-                        SEC_ACE ace;
+                        struct security_ace ace;
                         if (!parse_ace(ipc_cli, pol, &ace, numeric, tok+4)) {
                                 DEBUG(5, ("Failed to parse ACL %s\n", tok));
@@ -519 +518 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok,"ACL+:", 5) == 0) {
-                        SEC_ACE ace;
+                        struct security_ace ace;
                         if (!parse_ace(ipc_cli, pol, &ace, False, tok+5)) {
                                 DEBUG(5, ("Failed to parse ACL %s\n", tok));
@@ -532 +531 @@
                         continue;
                 }
-                
+
                 DEBUG(5, ("Failed to parse security descriptor\n"));
                 goto done;
         }
-        
+
         ret = make_sec_desc(ctx, revision, SEC_DESC_SELF_RELATIVE, 
                             owner_sid, group_sid, NULL, dacl, &sd_size);
-        
+
 done:
         SAFE_FREE(group_sid);
         SAFE_FREE(owner_sid);
-        
         return ret;
 }
@@ -563 +561 @@
         SMB_INO_T inode = 0;
         DOS_ATTR_DESC *ret;
-        
+
         ret = TALLOC_P(ctx, DOS_ATTR_DESC);
         if (!ret) {
@@ -569 +567 @@
                 return NULL;
         }
-        
+
         /* Obtain the DOS attributes */
         if (!SMBC_getatr(context, srv, CONST_DISCARD(char *, filename),
@@ -582 +580 @@
                 return NULL;
         }
-        
+
         ret->mode = mode;
         ret->size = size;
@@ -590 +588 @@
         ret->change_time = convert_timespec_to_time_t(change_time_ts);
         ret->inode = inode;
-        
+
         return ret;
 }
@@ -612 +610 @@
                 const char * change_time_attr;
         } attr_strings;
-        
+
         /* Determine whether to use old-style or new-style attribute names */
         if (context->internal->full_time_names) {
@@ -627 +625 @@
                 attr_strings.change_time_attr = "C_TIME";
         }
-        
+
         /* if this is to set the entire ACL... */
         if (*str == '*') {
@@ -637 +635 @@
                 }
         }
-        
+
         frame = talloc_stackframe();
         while (next_token_talloc(frame, &p, &tok, "\t,\r\n")) {
@@ -652 +650 @@
                         continue;
                 }
-                
+
                 if (StrnCaseCmp(tok, "SIZE:", 5) == 0) {
                         dad->size = (SMB_OFF_T)atof(tok+5);
                         continue;
                 }
-                
+
                 n = strlen(attr_strings.access_time_attr);
                 if (StrnCaseCmp(tok, attr_strings.access_time_attr, n) == 0) {
@@ -663 +661 @@
                         continue;
                 }
-                
+
                 n = strlen(attr_strings.change_time_attr);
                 if (StrnCaseCmp(tok, attr_strings.change_time_attr, n) == 0) {
@@ -669 +667 @@
                         continue;
                 }
-                
+
                 n = strlen(attr_strings.write_time_attr);
                 if (StrnCaseCmp(tok, attr_strings.write_time_attr, n) == 0) {
@@ -675 +673 @@
                         continue;
                 }
-                
+
                 if (attr_strings.create_time_attr != NULL) {
                         n = strlen(attr_strings.create_time_attr);
@@ -685 +683 @@
                         }
                 }
-                
+
                 if (StrnCaseCmp(tok, "INODE:", 6) == 0) {
                         dad->inode = (SMB_INO_T)atof(tok+6);
@@ -732 +730 @@
         bool determine_size = (bufsize == 0);
         uint16_t fnum;
-        SEC_DESC *sd;
+        struct security_descriptor *sd;
         fstring sidstr;
         fstring name_sandbox;
@@ -762 +760 @@
                 const char * change_time_attr;
         } excl_attr_strings;
-        
+
         /* Determine whether to use old-style or new-style attribute names */
         if (context->internal->full_time_names) {
@@ -770 +768 @@
                 attr_strings.write_time_attr = "WRITE_TIME";
                 attr_strings.change_time_attr = "CHANGE_TIME";
-                
+
                 excl_attr_strings.create_time_attr = "CREATE_TIME";
                 excl_attr_strings.access_time_attr = "ACCESS_TIME";
@@ -781 +779 @@
                 attr_strings.write_time_attr = "M_TIME";
                 attr_strings.change_time_attr = "C_TIME";
-                
+
                 excl_attr_strings.create_time_attr = NULL;
                 excl_attr_strings.access_time_attr = "dos_attr.A_TIME";
@@ -787 +785 @@
                 excl_attr_strings.change_time_attr = "dos_attr.C_TIME";
         }
-        
+
         /* Copy name so we can strip off exclusions (if any are specified) */
         strncpy(name_sandbox, attr_name, sizeof(name_sandbox) - 1);
-        
+
         /* Ensure name is null terminated */
         name_sandbox[sizeof(name_sandbox) - 1] = '\0';
-        
+
         /* Play in the sandbox */
         name = name_sandbox;
-        
+
         /* If there are any exclusions, point to them and mask them from name */
         if ((pExclude = strchr(name, '!')) != NULL)
@@ -802 +800 @@
                 *pExclude++ = '\0';
         }
-        
+
         all = (StrnCaseCmp(name, "system.*", 8) == 0);
         all_nt = (StrnCaseCmp(name, "system.nt_sec_desc.*", 20) == 0);
@@ -810 +808 @@
         some_dos = (StrnCaseCmp(name, "system.dos_attr.", 16) == 0);
         numeric = (* (name + strlen(name) - 1) != '+');
-        
+
         /* Look for exclusions from "all" requests */
         if (all || all_nt || all_dos) {
-                
                 /* Exclusions are delimited by '!' */
                 for (;
                      pExclude != NULL;
                      pExclude = (p == NULL ? NULL : p + 1)) {
-                        
+
                         /* Find end of this exclusion name */
                         if ((p = strchr(pExclude, '!')) != NULL)
@@ -824 +821 @@
                                 *p = '\0';
                         }
-                        
+
                         /* Which exclusion name is this? */
                         if (StrCaseCmp(pExclude,
@@ -878 +875 @@
                 }
         }
-        
+
         n_used = 0;
-        
+
         /*
          * If we are (possibly) talking to an NT or new system and some NT
@@ -951 +948 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -961 +958 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_nt_owner) {
                         /* Get owner and group sid */
@@ -972 +969 @@
                                 fstrcpy(sidstr, "");
                         }
-                        
+
                         if (all || all_nt) {
                                 if (determine_size) {
@@ -999 +996 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1009 +1006 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_nt_group) {
                         if (sd->group_sid) {
@@ -1018 +1015 @@
                                 fstrcpy(sidstr, "");
                         }
-                        
+
                         if (all || all_nt) {
                                 if (determine_size) {
@@ -1045 +1042 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1055 +1052 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_nt_acl) {
                         /* Add aces to value buffer  */
                         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
-                                
-                                SEC_ACE *ace = &sd->dacl->aces[i];
+
+                                struct security_ace *ace = &sd->dacl->aces[i];
                                 convert_sid_to_string(ipc_cli, pol,
                                                       sidstr, numeric,
                                                       &ace->trustee);
-                                
+
                                 if (all || all_nt) {
                                         if (determine_size) {
@@ -1147 +1144 @@
                         }
                 }
-                
+
                 /* Restore name pointer to its original value */
                 name -= 19;
         }
-        
+
         if (all || some_dos) {
                 /* Point to the portion after "system.dos_attr." */
                 name += 16;     /* if (all) this will be invalid but unused */
-                
+
                 /* Obtain the DOS attributes */
                 if (!SMBC_getatr(context, srv, filename, &mode, &size, 
@@ -1163 +1160 @@
                                  &change_time_ts,
                                  &ino)) {
-                        
+
                         errno = SMBC_errno(context, srv->cli);
                         return -1;
-                        
-                }
-                
+                }
+
                 create_time = convert_timespec_to_time_t(create_time_ts);
                 access_time = convert_timespec_to_time_t(access_time_ts);
                 write_time = convert_timespec_to_time_t(write_time_ts);
                 change_time = convert_timespec_to_time_t(change_time_ts);
-                
+
                 if (! exclude_dos_mode) {
                         if (all || all_dos) {
@@ -1211 +1207 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1221 +1217 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_size) {
                         if (all || all_dos) {
@@ -1256 +1252 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1266 +1262 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_create_time &&
                     attr_strings.create_time_attr != NULL) {
@@ -1299 +1295 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1309 +1305 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_access_time) {
                         if (all || all_dos) {
@@ -1341 +1337 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1351 +1347 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_write_time) {
                         if (all || all_dos) {
@@ -1383 +1379 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1393 +1389 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_change_time) {
                         if (all || all_dos) {
@@ -1425 +1421 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1435 +1431 @@
                         n = 0;
                 }
-                
+
                 if (! exclude_dos_inode) {
                         if (all || all_dos) {
@@ -1470 +1466 @@
                                 }
                         }
-                        
+
                         if (!determine_size && n > bufsize) {
                                 errno = ERANGE;
@@ -1480 +1476 @@
                         n = 0;
                 }
-                
+
                 /* Restore name pointer to its original value */
                 name -= 16;
         }
-        
+
         if (n_used == 0) {
                 errno = ENOATTR;
                 return -1;
         }
-        
+
         return n_used;
 }
@@ -1509 +1505 @@
         uint16_t fnum = (uint16_t)-1;
         int err = 0;
-        SEC_DESC *sd = NULL, *old;
-        SEC_ACL *dacl = NULL;
-        DOM_SID *owner_sid = NULL;
-        DOM_SID *group_sid = NULL;
+        struct security_descriptor *sd = NULL, *old;
+        struct security_acl *dacl = NULL;
+        struct dom_sid *owner_sid = NULL;
+        struct dom_sid *group_sid = NULL;
         uint32 i, j;
         size_t sd_size;
@@ -1520 +1516 @@
         char *targetpath = NULL;
         struct cli_state *targetcli = NULL;
+        NTSTATUS status;
 
         /* the_acl will be null for REMOVE_ALL operations */
@@ -1526 +1523 @@
                            p > the_acl &&
                            p[-1] != '+');
-                
+
                 /* if this is to set the entire ACL... */
                 if (*the_acl == '*') {
@@ -1532 +1529 @@
                         the_acl = p + 1;
                 }
-                
+
                 sd = sec_desc_parse(ctx, ipc_cli, pol, numeric, the_acl);
-                
                 if (!sd) {
                         errno = EINVAL;
@@ -1540 +1536 @@
                 }
         }
-        
+
         /* SMBC_XATTR_MODE_REMOVE_ALL is the only caller
            that doesn't deref sd */
-        
+
         if (!sd && (mode != SMBC_XATTR_MODE_REMOVE_ALL)) {
                 errno = EINVAL;
@@ -1602 +1598 @@
                                 }
                         }
-                        
+
                         if (!found) {
                                 err = ENOATTR;
@@ -1610 +1606 @@
                 }
                 break;
-                
+
         case SMBC_XATTR_MODE_ADD:
                 for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
                         bool found = False;
-                        
+
                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
-                                if (sid_equal(&sd->dacl->aces[i].trustee,
+                                if (dom_sid_equal(&sd->dacl->aces[i].trustee,
                                               &old->dacl->aces[j].trustee)) {
                                         if (!(flags & SMBC_XATTR_FLAG_CREATE)) {
@@ -1628 +1624 @@
                                 }
                         }
-                        
+
                         if (!found && (flags & SMBC_XATTR_FLAG_REPLACE)) {
                                 err = ENOATTR;
@@ -1634 +1630 @@
                                 goto failed;
                         }
-                        
+
                         for (i=0;sd->dacl && i<sd->dacl->num_aces;i++) {
                                 add_ace(&old->dacl, &sd->dacl->aces[i], ctx);
@@ -1641 +1637 @@
                 dacl = old->dacl;
                 break;
-                
+
         case SMBC_XATTR_MODE_SET:
                 old = sd;
@@ -1648 +1644 @@
                 dacl = old->dacl;
                 break;
-                
+
         case SMBC_XATTR_MODE_CHOWN:
                 owner_sid = sd->owner_sid;
                 break;
-                
+
         case SMBC_XATTR_MODE_CHGRP:
                 group_sid = sd->group_sid;
                 break;
         }
-        
+
         /* Denied ACE entries must come before allowed ones */
         sort_acl(old->dacl);
-        
+
         /* Create new security descriptor and set it */
         sd = make_sec_desc(ctx, old->revision, SEC_DESC_SELF_RELATIVE,
                            owner_sid, group_sid, NULL, dacl, &sd_size);
-        
+
         if (!NT_STATUS_IS_OK(cli_ntcreate(targetcli, targetpath, 0,
                              WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS, 0,
@@ -1673 +1669 @@
                 return -1;
         }
-        
-        if (!cli_set_secdesc(targetcli, fnum, sd)) {
+
+        status = cli_set_secdesc(targetcli, fnum, sd);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(5, ("ERROR: secdesc set failed: %s\n",
-                        cli_errstr(targetcli)));
+                          nt_errstr(status)));
                 ret = -1;
         }
-        
+
         /* Clean up */
-        
+
 failed:
         cli_close(targetcli, fnum);
-        
+
         if (err != 0) {
                 errno = err;
         }
-        
+
         return ret;
 }
@@ -1719 +1716 @@
         } attr_strings;
         TALLOC_CTX *frame = talloc_stackframe();
-        
+
         if (!context || !context->internal->initialized) {
-                
                 errno = EINVAL;  /* Best I can think of ... */
                 TALLOC_FREE(frame);
                 return -1;
         }
-        
+
         if (!fname) {
                 errno = EINVAL;
@@ -1732 +1728 @@
                 return -1;
         }
-        
+
         DEBUG(4, ("smbc_setxattr(%s, %s, %.*s)\n",
                   fname, name, (int) size, (const char*)value));
-        
+
         if (SMBC_parse_path(frame,
                             context,
@@ -1750 +1746 @@
                 return -1;
         }
-        
+
         if (!user || user[0] == (char)0) {
                 user = talloc_strdup(frame, smbc_getUser(context));
@@ -1759 +1755 @@
                 }
         }
-        
+
         srv = SMBC_server(frame, context, True,
                           server, share, &workgroup, &user, &password);
@@ -1766 +1762 @@
                 return -1;  /* errno set by SMBC_server */
         }
-        
+
         if (! srv->no_nt_session) {
                 ipc_srv = SMBC_attr_server(frame, context, server, share,
@@ -1776 +1772 @@
                 ipc_srv = NULL;
         }
-        
+
         /*
          * Are they asking to set the entire set of known attributes?
@@ -1792 +1788 @@
                         return -1;
                 }
-                
+
                 if (ipc_srv) {
                         ret = cacl_set(context, talloc_tos(), srv->cli,
@@ -1804 +1800 @@
                         ret = 0;
                 }
-                
+
                 /* get a DOS Attribute Descriptor with current attributes */
                 dad = dos_attr_query(context, talloc_tos(), path, srv);
@@ -1810 +1806 @@
                         /* Overwrite old with new, using what was provided */
                         dos_attr_parse(context, dad, srv, namevalue);
-                        
+
                         /* Set the new DOS attributes */
                         if (! SMBC_setatr(context, srv, path,
@@ -1818 +1814 @@
                                           dad->change_time,
                                           dad->mode)) {
-                                
+
                                 /* cause failure if NT failed too */
                                 dad = NULL; 
                         }
                 }
-                
+
                 /* we only fail if both NT and DOS sets failed */
                 if (ret < 0 && ! dad) {
@@ -1831 +1827 @@
                         ret = 0;
                 }
-                
+
                 TALLOC_FREE(frame);
                 return ret;
         }
-        
+
         /*
          * Are they asking to set an access control element or to set
@@ -1845 +1841 @@
             StrnCaseCmp(name, "system.nt_sec_desc.acl", 22) == 0 ||
             StrnCaseCmp(name, "system.nt_sec_desc.acl+", 23) == 0) {
-                
+
                 /* Yup. */
                 char *namevalue =
                         talloc_asprintf(talloc_tos(), "%s:%s",
                                         name+19, (const char *) value);
-                
+
                 if (! ipc_srv) {
                         ret = -1; /* errno set by SMBC_server() */
@@ -1869 +1865 @@
                 return ret;
         }
-        
+
         /*
          * Are they asking to set the owner?
@@ -1875 +1871 @@
         if (StrCaseCmp(name, "system.nt_sec_desc.owner") == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.owner+") == 0) {
-                
+
                 /* Yup. */
                 char *namevalue =
                         talloc_asprintf(talloc_tos(), "%s:%s",
                                         name+19, (const char *) value);
-                
+
                 if (! ipc_srv) {
                         ret = -1; /* errno set by SMBC_server() */
@@ -1895 +1891 @@
                 return ret;
         }
-        
+
         /*
          * Are they asking to set the group?
@@ -1901 +1897 @@
         if (StrCaseCmp(name, "system.nt_sec_desc.group") == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.group+") == 0) {
-                
+
                 /* Yup. */
                 char *namevalue =
                         talloc_asprintf(talloc_tos(), "%s:%s",
                                         name+19, (const char *) value);
-                
+
                 if (! ipc_srv) {
                         /* errno set by SMBC_server() */
@@ -1922 +1918 @@
                 return ret;
         }
-        
+
         /* Determine whether to use old-style or new-style attribute names */
         if (context->internal->full_time_names) {
@@ -1937 +1933 @@
                 attr_strings.change_time_attr = "system.dos_attr.C_TIME";
         }
-        
+
         /*
          * Are they asking to set a DOS attribute?
@@ -1948 +1944 @@
             StrCaseCmp(name, attr_strings.write_time_attr) == 0 ||
             StrCaseCmp(name, attr_strings.change_time_attr) == 0) {
-                
+
                 /* get a DOS Attribute Descriptor with current attributes */
                 dad = dos_attr_query(context, talloc_tos(), path, srv);
@@ -1961 +1957 @@
                                 /* Overwrite old with provided new params */
                                 dos_attr_parse(context, dad, srv, namevalue);
-                                
+
                                 /* Set the new DOS attributes */
                                 ret2 = SMBC_setatr(context, srv, path,
@@ -1969 +1965 @@
                                                    dad->change_time,
                                                    dad->mode);
-                                
+
                                 /* ret2 has True (success) / False (failure) */
                                 if (ret2) {
@@ -1980 +1976 @@
                         ret = -1;
                 }
-                
+
                 TALLOC_FREE(frame);
                 return ret;
         }
-        
+
         /* Unsupported attribute name */
         errno = EINVAL;
@@ -2014 +2010 @@
         } attr_strings;
         TALLOC_CTX *frame = talloc_stackframe();
-        
+
         if (!context || !context->internal->initialized) {
-                
                 errno = EINVAL;  /* Best I can think of ... */
                 TALLOC_FREE(frame);
                 return -1;
         }
-        
+
         if (!fname) {
                 errno = EINVAL;
@@ -2027 +2022 @@
                 return -1;
         }
-        
+
         DEBUG(4, ("smbc_getxattr(%s, %s)\n", fname, name));
-        
+
         if (SMBC_parse_path(frame,
                             context,
@@ -2044 +2039 @@
                 return -1;
         }
-        
+
         if (!user || user[0] == (char)0) {
                 user = talloc_strdup(frame, smbc_getUser(context));
@@ -2053 +2048 @@
                 }
         }
-        
+
         srv = SMBC_server(frame, context, True,
                           server, share, &workgroup, &user, &password);
@@ -2060 +2055 @@
                 return -1;  /* errno set by SMBC_server */
         }
-        
+
         if (! srv->no_nt_session) {
                 ipc_srv = SMBC_attr_server(frame, context, server, share,
@@ -2070 +2065 @@
                 ipc_srv = NULL;
         }
-        
+
         /* Determine whether to use old-style or new-style attribute names */
         if (context->internal->full_time_names) {
@@ -2085 +2080 @@
                 attr_strings.change_time_attr = "system.dos_attr.C_TIME";
         }
-        
+
         /* Are they requesting a supported attribute? */
         if (StrCaseCmp(name, "system.*") == 0 ||
@@ -2112 +2107 @@
             StrCaseCmp(name, attr_strings.change_time_attr) == 0 ||
             StrCaseCmp(name, "system.dos_attr.inode") == 0) {
-                
+
                 /* Yup. */
                 char *filename = (char *) name;
@@ -2127 +2122 @@
                 return ret;
         }
-        
+
         /* Unsupported attribute name */
         errno = EINVAL;
@@ -2150 +2145 @@
         char *path = NULL;
         TALLOC_CTX *frame = talloc_stackframe();
-        
+
         if (!context || !context->internal->initialized) {
-                
                 errno = EINVAL;  /* Best I can think of ... */
                 TALLOC_FREE(frame);
                 return -1;
         }
-        
+
         if (!fname) {
                 errno = EINVAL;
@@ -2163 +2157 @@
                 return -1;
         }
-        
+
         DEBUG(4, ("smbc_removexattr(%s, %s)\n", fname, name));
-        
+
         if (SMBC_parse_path(frame,
                             context,
@@ -2180 +2174 @@
                 return -1;
         }
-        
+
         if (!user || user[0] == (char)0) {
                 user = talloc_strdup(frame, smbc_getUser(context));
@@ -2189 +2183 @@
                 }
         }
-        
+
         srv = SMBC_server(frame, context, True,
                           server, share, &workgroup, &user, &password);
@@ -2196 +2190 @@
                 return -1;  /* errno set by SMBC_server */
         }
-        
+
         if (! srv->no_nt_session) {
                 ipc_srv = SMBC_attr_server(frame, context, server, share,
@@ -2206 +2200 @@
                 ipc_srv = NULL;
         }
-        
+
         if (! ipc_srv) {
                 TALLOC_FREE(frame);
                 return -1; /* errno set by SMBC_attr_server */
         }
-        
+
         /* Are they asking to set the entire ACL? */
         if (StrCaseCmp(name, "system.nt_sec_desc.*") == 0 ||
             StrCaseCmp(name, "system.nt_sec_desc.*+") == 0) {
-                
+
                 /* Yup. */
                 ret = cacl_set(context, talloc_tos(), srv->cli,
@@ -2223 +2217 @@
                 return ret;
         }
-        
+
         /*
          * Are they asking to remove one or more spceific security descriptor
@@ -2235 +2229 @@
             StrnCaseCmp(name, "system.nt_sec_desc.acl", 22) == 0 ||
             StrnCaseCmp(name, "system.nt_sec_desc.acl+", 23) == 0) {
-                
+
                 /* Yup. */
                 ret = cacl_set(context, talloc_tos(), srv->cli,
@@ -2244 +2238 @@
                 return ret;
         }
-        
+
         /* Unsupported attribute name */
         errno = EINVAL;
@@ -2303 +2297 @@
                 ;
         const char * supported;
-        
+
         if (context->internal->full_time_names) {
                 supported = supported_new;
@@ -2311 +2305 @@
                 retsize = sizeof(supported_old);
         }
-        
+
         if (size == 0) {
                 return retsize;
         }
-        
+
         if (retsize > size) {
                 errno = ERANGE;
                 return -1;
         }
-        
+
         /* this can't be strcpy() because there are embedded null characters */
         memcpy(list, supported, retsize);